Security Engineer: Offensive Testing & Product Threat Modeling

Xage Security; Palo Alto (CA); On-site; USD 170,000 - 200,000; Full time

Job summary

Xage Security in Palo Alto, CA is seeking an experienced security professional focused on penetration testing, threat modeling, and security analysis of Xage’s products. You will ramp up on new features in a large codebase and perform manual testing to uncover business logic flaws, authorization bypasses, injection issues, and cryptographic misuses.

The role involves collaborating with multiple teams, extending automated tooling where appropriate, reviewing feature design and existing security

Qualifications

• Multiple years of hands-on offensive security experience (penetration testing, red teaming, vulnerability research, etc.) against software products.
• Must be fluent and capable enough in coding to understand features within the code base and help uncover vulnerabilities within our products.
• Strong understanding of common authentication and authorization protocols/areas such as OAuth, SAML, mTLS / PKI, SSO, MFA, FIDO2, RBAC/ABAC models.
• Strong Web and API security expertise, knowledgeable about OWASP/Top 10 issue, authentication flows, session management, injection issues, etc.
• Strong networking and protocol fundamentals, should be capable of reading traffic captures and understanding / reverse engineering custom protocols.
• Strong communication skills, both verbal and written
• Collaborative and willing to educate / mentor other team members

Responsibilities

• Offensive penetration testing of Xage’s products
• Penetrating testing areas include Web UIs, REST/gRPC APIs, desktop clients, backend services, and deployment infrastructure
• Testing should primarily focus on manual efforts which will require reading and understanding the code and architecture of existing Xage products and features
• As needed, contribute to the extension of existing automation tools or development of novel custom tooling to support detection efforts
• Threat modeling and security review of Xage products and features
• Help the product security team to provide input and sign-off on all new features being added to the product
• Contribute to continuous review of older features already existing in the product to help close any gaps from early stage products and software
• Provide input and guidance on brainstorming / architectural discussions to help educate and guide the team to appropriate security conscious design decisions
• Reporting issues, remediation, and verification of resolution
• Provide clear findings on any vulnerabilities discovered with reproduction steps and possible fixes
• Work alongside developers to remediate issues and push fixes through the development lifecycle
• Educate and expand the capabilities of developers to help them understand how to avoid common security issues
• Suggest improvements to libraries or tooling for development teams to help prevent security issues before they happen

Skills

Offensive security

Penetration testing

Web & API security

OAuth/SAML/mTLS

Strong communication

Code literacy

Team collaboration/mentoring

Job description

Xage Security in Palo Alto, CA is seeking an experienced security professional focused on penetration testing, threat modeling, and security analysis of Xage’s products. You will ramp up on new features in a large codebase and perform manual testing to uncover business logic flaws, authorization bypasses, injection issues, and cryptographic misuses.

The role involves collaborating with multiple teams, extending automated tooling where appropriate, reviewing feature design and existing security